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Quantum Secret Sharing (QSS) protocols between N players, for sharing classical secrets, either use multi¬ 
partite entangled states or use sequential manipulation of single d— level states only when d is prime & We 
propose a sequential scheme which is valid for any value of d. In contrast to 1271 1 whose efficiency (number 
of valid rounds) is the efficient of our scheme is 4 for any d. This, together with the fact that in the limit 
d —>• oo the scheme can be implemented by continuous variable optical states, brings the scheme into the 
domain of present day technology. 


Introduction: Quantum Key Distribution (QKD) Cl 0] 
is among the best experimentally developed areas |3[] in 
the field of quantum information science. With the rapid 
growth of demand for secure communication in our world, 
it is imaginable that in the near future it will soon be an 
integrated part of modem communication systems. At the 
very basis of this developments lies the fact that QKD either 
uses bi-partite entanglement [[0] or sequential preparation 
and measurements of states by two parties, both of which 
are within reach of present technologies. In view of the need 
for more and more collaborative activities. Quantum Secret 
Sharing (QSS) is at least at the same level of demand as 
QKD. QSS is the act of splitting a message so that only by 
collaboration of all the receivers, it can be retrieved. The 
question now is: is it possible to put Quantum Secret Sharing 
(QSS) between an arbitrary number of parties, on the same 
level of experimental feasibility as QKD? Until a few years 
ago, the answer seemed to be no, because the known QSS 
schemes relied on multi-partite entangled states which are 
much more difficult to prepare and more fragile than bi-partite 
ones. Recent developments seem to point to a positive answer 
to this questions. 


The idea of using entanglement for sharing a secret ke 
between three persons, was first briefly pointed out in 
and then developed in iH], where it was shown that local 
measurements of a GHZ state Q], enable three or four 
parties, to share a random sequence of bits as a secret key. 
Generalization to many parties using multipartite entangled 
states were developed in M- Generalization of QKD and 
QSS schemes to d— level states, again relying on multipartite 
entanglement, were studied in [10] and II1 il l respectively. 
Finally generalization of these entanglement-based schemes 
to continuous variable states |14j], were reported in many 
works [12, T31 15-2Cj], where in some of them like 112, 131 
the polarization degrees of freedom of photons and in the 
others coherent or Gaussian states of light were used. 


less amount of entanglement? This question received a partial 
positive answer, where it was shown that multipartite entan¬ 
glement of qubits can be replaced by two-body entanglement 
112111 or by product states 122112311 . the later works being a 
combination of two or more QKD protocols of BB84 types 
jlll and all of them using qubit states. A sequential scheme 
with a proof of principle for its experimental realization 
was then reported in 1 2411 where its security problem was 
discussed in [25] and [26!]. 


It was then quite natural to ask if this sequential scheme 
can be generalized for d-level states to which a p ositive 
answer was found for d being an odd prime in [27]. The 
efficiency ( the average percentage of valid rounds) of this 
scheme which uses a system of d + 1 Gaussian MUB’s is 
4, which becomes negligible for large d and vanishes for 
continuous variables. It is the aim of this letter is to propose 
an entanglement-free QSS protocol which is valid for any d, 
uses the simple generalized Pauli and Hadamard gates and 
leads to familiar operations in the continuous variable limit 
and moreover whose efficiency is 4 for all d. We hope that 
removing the previous restrictions, will bring the QSS scheme 
closer to experimental realization with current technology. 

In order to proceed a quick review of the method of 107] is 
in order, which is based on using Mutually Unbiased Bases 
(MUB) in Hilbert spaces of prime dimensions. There are 
N + 1 players which are denoted by Rq, Ri, R 2 , ■ ■ ■ Rn- 
The first player Rq prepares a reference state and acts on 
it by an operator which depends on two random integers 
0 < ao, bo < d — 1 and passes the state to the next player who 
acts similarly on the state. In the end the state which reaches 
the last player Bob depends on two parametes A YiLo a i 
and B := Yt=o h- This player always measures the received 
state in a fixed basis and only when B = 0 which happens 
1 out of d runs, there is perfect correlation between his mea¬ 
sured result m and the random numbers a, in the form 


Along with all this theoretical and experimental success 
and in view of the difficulty in creating and maintaining 
multi-party entangled states, a basic question has always been 
whether it is possible to do QSS between n parties by using 


N 

a % = m. (1) 

2—0 

In other rounds no correlation exist and the round is dis- 
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carded. If the protocol is run for « Ld rounds and a number 
of L rounds are successful, then a sequence of perfectly corre¬ 
lated random strings are shared between all the players. If we 
denote by FQ the long sequence of dits (a* i, a* 2 > a i ,3 ■ ■ • ch,l) 

for the *—th player, and by 1C = (—mi, —m 2 ,-mj,) the 

long sequence of negative-measured values by Rn, then ac¬ 
cording to 0 we have 


K, ® Kq © K\ ® K2 © ■ • • -Kjv = 0 (2) 

where by © we mean a dit-wise sum modulo d between all 
the strings. 





•]*) • 

•[«*) • 

• |" k'j • 

• | a -k) • 


While this is an important step, the restriction to prime 
dimensions and the specific form of the operators used by 
the players make it difficult to go to the limit of continuous 
variables, a limit which has been most promising in actual 
implementation of many protocols by optical means 114 1. 


FIG. 1: Color Online. The action of each player causes the point 
representing the state to do a random hopping in this lattice of states. 
It is important to note that the Z operators on the first and the third 
rows and the X operators on the second and fourth row do nothing 
(they just add overall phases). These phases can safely be ignored. 


In this letter we report an entanglement-free QSS scheme 
between N + 1 players who use a d— level state, where d 
is arbitrary. With d being arbitrary, one can now hope that 
experimental implementation will be much more feasible. 

QSS scheme using a single qudit state for general d: The 
key insight is to look at the protocol of |; 27f | as a random walk 
in a lattice of states, comprised of the bases of MUB’s. With 
this random walk picture at hand, we can alleviate the restric¬ 
tion to prime numbers by devising a new lattice and new hop¬ 
ping operators. We take a4xd lattice folded into a torus, 
where d is arbitrary. Let d be any positive integer and con¬ 
sider the computational orthonormal basis states for C d , the 
complex d dimensional Hilbert space as: 

B = {\k), 0 < k < d — 1} (3) 

Let w = e 2 ^ be the d —th root of unity and F be the Fourier 
transform operator defined as 


mutually unbiased basis with respect to B. Consider now the 
generalized Pauli operators X := 0 1^ + l)(fc| and Z := 

Y^t=o u k \k)(k\. These two operators act as shift operators on 
the bases B and B respectively: 

X\k) = \k+1), Z\£ k ) = |& +1 >. (8) 

Conversely when acting on the bases B and B, the operators 
X and Z act as phase operators: 

X|&>=w- fc |&>, Z\k)=uj k \k). (9) 

We also note that: 

F\k) = |&>, F\£ k ) = | - k). (10) 

In view of these relations it is convenient to draw the four 
rows of states of B and B in the order shown in figure ([]}. 


F := 


Vd 




(4) 


i,j =0 


The operator F has the following interesting properties, which 
result from the identity ^ i=c J uj r = d5 r ,o'- 

d -1 

p 2 =J 2 pi = L (5) 

fc =0 

Furthermore, when acting on the state | k), F creates another 
state | a k ) 


Running the protocol: 

• Step 1: Ro, starts from the state |0) and acts on it by 
the operators X a °Z bo F c ° (where 0 < ao,&o < d — 1 
are random integers and Co = 0,1). She then sends 
this state to the first player f?i who acts on the received 
state by X ai Z bl F Cl and then sends the state to the sec¬ 
ond player R 2 who does the same thing. The process 
repeats until the state reaches the last player /f.y. He 
also acts on the state by X aN Z bN F CN and measures it 
in the computational or B basis. The final state before 
this measurement is given by 


16c) 


1 

77i 


d -1 


E^' fe ifc>- 

j=0 


(6) 


N 

|^) = n (X ai Z bi F Ci )\0). (11) 

»=0 


which constitute another basis B, 

(7) 


• Step 2: After measurement of //y, all the players 
Ro, f?i, f? 2 , • • • Rn are asked by Alice (the one who 
controls the protocol whom we call Alice. She can be 


B ={|&>, 0<fc<d-l} 
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any of the players) to publicly announce their integers 
Ci which are 0 or 1. Also they can be asked by Alice 
to make this announcement in random order. It is cru¬ 
cial that the integers o, and I), are kept secret with the 
players and are not announced at any stage. If 

N 

'22 Ci = 0 mod 2 (12) 

i=0 

the round is treated as valid, since this means that 
the point has landed on the correct basis B for the 
measurement of Rn, otherwise it is discarded. 

• Step 3: In valid rounds, we are certain that the point 
representing the state lies on the computational basis B 
and when Rn measures this state he obtains a definite 
and deterministic value denoted by win■ In invalid 
rounds, due to the MUB property of the two bases B 
and B, a completely random result is obtained and no 
perfect correlation exists between the result of Rn 
measurements and the random bits applied by others. 

But what is the exact form of the correlation? It is not as 
simple as 0 . but it is as perfect as it is. Looking at the lattice 
in figure 0 , it is crucial to note that on the first and third rows, 
the Z operator does nothing (it just adds overall phase to the 
state). The same is true for the X operator on the second and 
fourth rows. This means that the effect of these operators on 
these respective rows can safely be ignored. So suppose that 
the operator F is applied only twice, by the players Ilk and 
Ri. Figure 0 shows the path of the random walk. Modulo an 
overall phase, the final state is given by: 

fc-l l -1 N 

I'E') = 1 a i ) := I 

2=0 i—k i—l 

(13) 

where 

s — 1 s — 1 

A r ,s '■= ^2 ^r,s ■= ^2 

2 —r i=r 

Or suppose that the operator F is applied four times, by the 
players Ilk , Ri, Rm and R n . Figure 0 shows the path of the 
random walk and the final state is given by: 

l^} = |^0,fc — 1 T Rk,l — 1 1 Rm,n— 1 T ^n,iv) (15) 

The pattern is now clear. Although it is straightforward, we 
do not attempt to clutter the text with writing general formulas 
for the final state corresponding to a given random path. The 
point to emphasize is that once the numbers Ci are publicly 
announced, all the parties; Rq to Rn know the positions of 
the F operators, the vertical steps. Note that the vertical steps 
are of unit size. In those valid rounds, the value measured by 
Rn has perfect correlation with those used by all the other 



• •••••••• 

• •••••••• 

FIG. 2: Color Online. A simple example of a random path in the 
lattice of states, when only 2 players apply F operators. In order not 
to clutter the figure, we have shown all the steps to be of unit-size 
(between neighboring sites). The steps can be of any size between 
non-neighboring sites. The first and the last rows are the same. 



FIG. 3: Color Online. A simple example of a random path in the 
lattice of states, when only 4 players apply F operators. 

parties. Let us elaborate this by an example. Suppose there 
are 6 players Rq to Hr, and two F operators are used in round 

1 and round 2, but in two different places. For example in 
round 1 the F operators are in positions (2 and 5) and in round 

2 the F operators are in positions (1 and 4). Then according 
to G 3 if we denote the values that f ? 5 measures in these two 
rounds respectively by m and to', we will have 

a 0 + ai + 6 2 + b 3 + 64 — a 5 = m 5 

a o + K + b' 2 + 63 - a,' 4 - a’ 5 = m' 5 . (16) 

Since the positins of the F operators (the vertical steps) are 
known by the public announcement of all the c,’s, they know 
how to arrange their Keys Kq, K \, ■ ■ ■ Kr, from the above 
d— level integers. For example, the first numbers of these 
Keys are: K 0 = (a 0 , a' 0 , ■ ■ ■), K ± = (a ,&!,-••) K 2 = 
( 62 , b' 2 , ■ ■ •), K 3 = ( 63 , 63 , • • •), K a = ( 64 , —a' 4 , ■ ■ •), K 5 = 
(—ag, —a' 5 , ■ ■ ■), and M 5 = (—ms, -m' 5 ,- ■ •). Then we have 

K 0 ®K l ®K 2 ®K 3 ®K 4 ®Ks®Ms = 0 . (17) 

In this way a secret key is created between all the parties 
which can be used for sharing messages via public classical 
channels. 
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• Using the shared key: Let us denote the random string 
Km + J\4n of the last player by JC y. Therefore the 
shared random key which has been established satisfies: 
Kq + K\ + • • • Kpj —i + IC N = 0 
Like any other QSS scheme, any player R, can play 
the role of Alice who wants to send a secret message to 
another player Rj (playing the role of Bob) who will 
retrieve the message by the collaboration of other par¬ 
ties. Alice can send a message A4 in the form A4 ® K, 
to Bob. Alice who now controls the protocol, (like 
any other QSS scheme) asks the other parties to send 
their random keys to Bob who retrieves the message by 
performing the relation (A4 © JQ) © Y l7 £,. Kj which 
in view of the previous relation gives the message A4. 

Security against attacks: We can now consider how the 
protocol is secure against attacks. A round of the protocol 
corresponds to a random path on the lattice of states as shown 
in figure ( 0 - If any of the players wants to measure his 
received qudit and keeps a copy of it, he should know the 
basis, but this is not possible for him, because the integers 
d or equivalently the F moves, are announced only after 
all measurements are done. Since the two bases B and B 
are MUB with respect to each other, blind measurement in 
a basis, causes an error rate of 4=1 in the final measured 
qudit by Bob. This type of intervention or cheating is easily 
detectable by publicly comparing a subsequence of the shared 
key. These considerations also apply if a group of players 
enter a plot to intercept the key, since they can be collectively 
considered as a single party to which the basis used by the 
previous parties is not known. 

Another conceivable attach is that a group of players, 
each entangle their respective received qudits from previous 
players to some ancilla and store part of the information in 
these ancillas. They can then collaborate with each other 
and share this collected information to retrieve the key. A 
standard way for entangling a received state | ip) to an ancilla 
is to start the ancilla in the state |+) := XXXo 1 1*) anc * 
act on the joint state |+) © \ip) by a (generalized Controlled 
Not (CNOT) operator, CNOT\i,j) := | i,i + j). If the 
received state is a computational state |g), , then this action 
results in CNOT\+ ) © |g) = -4= YiZ o I*) ® \i + q), which 
is a maximally entangled state. In this way the ancilla will 
be in a completely mixed state and stores no information 
of the qudit q. However if the received qudit is of the 
form |£ g ), that is, a Fourier basis state, then the ancilla can 
indeed store some information of q. In this case we find that 
CNOT\+) © |£ g ) = |£- 9 ) © |£ g ). In this way, information 
about q is stored in the ancilla without leaving any trace in the 
state |£ g ) which is being communicated between the players. 
Each player can then measure his ancilla in the Fourier basis 
B and retrieve q. However since a received state can be in 
one of the states \q) or |£ g ) with equal probability, each player 
has a 50 percent chance of successfully storing information 


in his ancilla, leaving no trace in the transmitted state |£ g ), 
and 50 percent chance of completely de-cohering the state 
| < 7 ). In this second case he commits an error rate of 4=4 on 
each state. Again by publicly announcing a subsequence of 
the key, the players can discern the existence of a plot within 
the group. 

Conclusion We have proposed a new scheme for multi¬ 
party secret sharing which uses a single d— level state for ar¬ 
bitrary d, and alleviates the need for entanglement. The basic 
idea is the analogy with a random walk performed by a parti¬ 
cle through a lattice of states. This walk is the result of random 
sequential unitary operations on a single particle by the play¬ 
ers one after the other. In view of the fact that the players do 
not have information about each others unitary operations, the 
path of the particle resembles a random walk which lands on 
a particular row (a particular basis) only when certain condi¬ 
tions are met. This condition is revealed only after public an¬ 
nouncement of some parameters of the operations after all the 
measurements have been done. In the limit of d —> 00, the 
local actions of the players will become X(s)Z(t)F c where s 
and t are continuous variables and c = 0,1. Here X (s) = e lsp 
and Z(t) = e ltx with x and p the position and momentum op¬ 
erators ([ x,p\ = ih) (corresponding to the quadratures of aa 
mode of electromagnetic field) and F the Fourier transform 
between the position and momentum bases. Quantum opti¬ 
cal realizations of these relations then puts this protocol quite 
within the reach of present day technology. 
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